0

Let's say I call window.alert('my message') in dart code. But what if (exactly my case) there is a script which did override alert function before my script. Now if I try to call window.alert('message') It executes overridden alert function instead of initial one.

Is there a mechanism to ensure that all functions are not overridden in described way? Or should I always make sure that dart script is the first to execute on page to ensure that no undesirable overrides are done and behavior is stable and it's the only way to go?

Here is basic github repo if you would like to see the issue live.

EDIT 1:

main.dart

import 'dart:html';

void main() {
  window.alert('alert');
}

index.html

<html>
<head>
    <title>test</title>
    <script>
        alert = (variable) => confirm("hehe it's jinxed");
    </script>
    <script defer src="main.dart.js"></script>
</head>
</html>
lrn
  • 64,680
  • 7
  • 105
  • 121
Georgii
  • 442
  • 4
  • 11
  • You are required to post a [mcve] here, **within your question**, and [not a link](https://meta.stackoverflow.com/a/254430/162698) to any other site if that code is needed, in this case, to answer your question. – Rob Jan 24 '21 at 15:19

1 Answers1

0

That does not sound possible.

If something "overrides" the JavaScript alert function, it actually overwrites the alert property of the window object. The old value is completely lost at that point, and it's not (easily) possible to even detect that this has happened.

If your code doesn't run first in a web browser, you can't protect yourself from this. If your code does run first, you can use Object.freeze or similar functionality to lock down the original properties, or take copies of them into your own variables. Simply running first is not a guarantee, if your code just uses window.alert directly later. You have to make an effort to prevent later code from overwriting it too.

This is really a JavaScript issue, there is nothing special about dart:html or Dart compiled code in this, it affects any JavaScript code which doesn't run first in a browser.

lrn
  • 64,680
  • 7
  • 105
  • 121
  • I feel that you are not exactly right about this being not possible at all as there is at least a trick with creating iframe and getting function values from it: https://stackoverflow.com/questions/8580431/recovering-built-in-methods-that-have-been-overwritten. – Georgii Jan 25 '21 at 10:25
  • That is a nice hack. As mentioned in that thread, it's not a completely safe replacement because it refers to the prototypes from the iframe, not the current frame. It most likely won't work for DOM methods. For some functions it will definitely work ... or, well, we're getting into ["Reflections on Trusting Trust"](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf) territory here, so "someone" might also have replaced the `document.createElement` function to intercept `iframe` creation and then fiddled with the functions of the created `iframe` too. – lrn Jan 25 '21 at 20:09